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Using a neutron double-slit setup, we construct a quantum bit commitment scheme in which time 
development of quantum states plays an essential role. Our scheme evades the widely accepted 
no-go theorem by the fact that it is neither possible to stop the time evolution of spreading wave 
packets, nor is it possible to evolve them backward in time. Moreover, for unstable particles such as 
neutrons, one cannot delay detecting their positions indefinitely, or they would disintegrate sponta- 
neously and escape detection. We find that using non-stationary states instead of stationary ones, 
unconditionally secure quantum bit commitment is possible. 
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Quantum cryptography is one of the most success- 
ful branches of quantum information science. The 
well known BB84 quantum key distribution proto- 
col was proposed early in 1984 [lj, and to date it has 
been implemented in the real world over distances 
as large as hundreds of kilometers 0] ■ Besides quan- 
tum key distribution there are also many other in- 
teresting cryptographic protocols among which the 
primitive quantum bit commitment occupies a spe- 
cial position. The security of quantum bit commit- 
ment (QBC) is an important issue because secure 
QBC can be used as an building block for other 
more complicated cryptographic protocols H such 
as quantum coin tossing |4| and quantum oblivious 
transfer Furthermore it is known that, at least 

in classical models, oblivious transfer can be used to 
implement secure two-party computation [i| [13] ■ So 
it seems that the security of QBC also holds the key 
to this long standing problem in cryptography as 
well. 

Bit commitment involves two distrusting parties 
customarily named Alice and Bob. In the beginning 
Alice commits to Bob a secret bit b £ {0, 1} that is 
to be revealed at some later time. In order to en- 
sure Bob that she will keep her commitment, Alice 
provides Bob with a piece of evidence with which he 
can verify her honesty when she finally unveils the 
committed bit. A bit commitment protocol is secure 
if it satisfies the following two conditions. (1) Con- 
cealing: Bob gets no information about the value of 
b before Alice unveils it; (2) Binding: Alice cannot 
change b without Bob's knowledge. (In general both 
conditions are satisfied only asymptotically as some 
security parameter N becomes large.) Furthermore, 



if the protocol remains secure even if Alice and Bob 
had capabilities limited only by the laws of nature 
(this is sometimes referred to as the parties having 
unlimited computational power), then it is said to 
be unconditionally secure. 

Consider a simple classical example. Alice writes 
down her committed bit b on a piece of paper and 
locks it in a box. She gives the box to Bob as evi- 
dence of her commitment but keeps the key to her- 
self. Alice unveils by announcing the value of b and 
giving the key to Bob for verification. This proto- 
col seems secure because Alice cannot change the 
bit value without access to the box, and Bob cannot 
open the box without the key. However, as with all 
other classical cryptographic schemes, it is not un- 
conditionally secure because, e.g., Bob's ability to 
open the box by himself cannot be ruled out as a 
matter of principle. By introducing quantum me- 
chanics into bit commitment, one hopes to achieve 
unconditional security which is guaranteed by the 
laws of nature. 

In a QBC protocol, Alice and Bob execute a series 
of quantum and classical operations during the com- 
mitment procedure, which finally results in a quan- 
tum state p£ in Bob's hand. If 
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then the protocol is perfectly concealing, and Bob is 
not able to extract any information about the value 
of b from p^ '. When Alice reveals the value of b, 
she must also provide additional information which, 
together with pg , will allow Bob to check if she is 
honest. 

For some time a QBC protocol [llj proposed in 
1993 was widely believed to be unconditionally se- 
cure, but it was eventually shown otherwise 
Moreover, a "no-go theorem" was put forth in 1997 
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,14], which supposedly proved that concealing 
protocols can always be cheated by Alice, conse- 
quently unconditionally secure QBC is ruled out as a 
matter of principle. Due to the importance of QBC, 
this result, if true, constitutes a major setback for 
quantum cryptography. 

Before proceeding further, it is instructive to out- 
line the impossibility proof for the perfectly conceal- 
ing case HiJ ■ The proof is based on the assump- 
tion that, by quantum entanglement, Alice and Bob 
can keep all undisclosed classical information unde- 
termined and stored them at the quantum level. In 
other words, they can delay all prescribed measure- 
ments without consequences until it is required to 
disclose the outcomes. It then follows that at the 
end of the commitment phase, there always exists a 
pure state l^^) in the joint Hilbcrt space Ha®Hb 
of Alice and Bob. \^ab) is called a quantum purifi- 
cation of the evidence state pg , such that 
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where the trace is over Alice's share of the state. 
Note that whether Bob purifies or not is irrelevant 
to Alice, and she could simply assume he does. In 
general purification requires access to quantum com- 
puters, which is consistent with the assumption that 
Alice and Bob have unlimited computational power. 

Since the protocol is assumed to be perfectly con- 
cealing, therefore Eq. (fTJ) holds. Then, according 
to a theorem by Hughston et al. jl8|, the two pu- 
rifications |^^) and \^ab) are related by a local 
unitary transformation Ua on Alice's side, namely, 
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Since Ua acts on Ha only, she can implement it 
without Bob's help. Then it is obvious that Alice 
can change her commitment at will, and Bob will 
always conclude that she is honest because his den- 
sity matrix is not affected by Ua- So it seems 
that no QBC protocols could be simultaneously con- 
cealing and binding [l3|, [l4[ ■ 

It has been shown that, if we do not adhere to 
the standard cryptographic scenario and allow Alice 
and Bob to control two separated sites each, then 
an unconditionally secure classical bit commitment 
protocol can be constructed using relativistic effects 
[15| . Nevertheless, in this paper, we are interested 
only in non-relativistic quantum bit commitment in 
the standard scenario where each party controls only 
one site. 

Since 1997, there have been many attempts at 
breaking the no-go theorem [l6j . however a math- 
ematically rigorous result is still lacking so far. 
Conceptually, the claim that unconditionally secure 



QBC is ruled out in principle is rather puzzling to 
some. First of all, while the objective of QBC is well 
defined, the corresponding procedure is not precisely 
specified. That is, there exists no general mathe- 
matical characterization of all imaginable QBC pro- 
tocols |17j . So it is unlikely that the no-go theorem 
could have blocked all possible routes to uncondi- 
tionally secure QBC. Secondly, when something in 
nature is forbidden, there usually exists a deeper and 
more general reason or principle behind it. Thus, for 
example, electric charge can neither be created nor 
destroyed because electromagnetic interactions obey 
an exact U(l) gauge symmetry; arbitrary quantum 
states cannot be perfectly cloned because informa- 
tion cannot be transmitted faster than the speed of 
light; etc. However unconditionally secure QBC is 
not known to violate any laws in physics or informa- 
tion theory, so why should it be strictly ruled out? 

As we saw above, the no-go theorem considers 
only stationary states which do not have significant 
time evolution properties. However a complete im- 
possibility proof should take into account the ef- 
fect of time evolution of quantum states in general. 
Therefore if a protocol uses non-stationary states 
to carry quantum information, then it is not cov- 
ered by the no-go theorem. In the following discus- 
sion, instead of stationary states, we shall use parti- 
cles whose spatial wavefunctions are spreading wave 
packets (their spins are irrelevant). Moreover they 
are unstable particles with finite lifetimes. 

Consider the following example. Alice and Bob 
shares a pure maximally entangled state of two par- 
ticles \^AB{x,t)), where (£,t) refer to particle-A, 
and the degrees of freedom of particle-!? are not 
explicitly shown. Particle-A's spatial wavefunction 
involves spreading wave packets of macroscopic di- 
mension while its spin is irrelevant. It is well known 
that the wavefunction at t = to and t — t\ (t% > to) 
are related by a unitary time evolution operator 
U(ti,t ), namely, 



\4>AB(x,h)) =U{t 1 ,t )\lpAB(x,t Q )), (4) 
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Ha = p 2 /2m a is the free-particle Hamiltonian op- 
erator of particle-A, and we have assumed Hg = 
for simplicity. Suppose to commit to b = 0, Alice is 
required to determine particle- A's position at t = to, 
and for b = 1 she must do so at time t = t\ (t± > to). 
Clearly the wavefunctions involved are not station- 
ary, and schemes of this type are therefore not ruled 
out by the no-go theorem. We show below that in- 
deed the impossibility proof does not go through. 

To proceed, let us follow the cheating strategy 
suggested by the no-go theorem: For 6 = 0, Alice 
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measures the particle position coherently at t = to 
with unitary operation and ancilla (suppose it is 
possible). The resulting pure state can be written 
schematically as 

|*i°i(x ) io)) = M[|$}|^(f,i ))] ) (6) 

where |<£>) is the ancilla state, and M is a local uni- 
tary operator which entangles <!>} with \iPab(x, to)). 
If necessary the outcome of the measurement can be 
obtained by a projective measurement on the ancilla 
state. Likewise if she commits to b = 1, 

*i)> =M[|$}|^fl(2,ti)>]. (7) 

So mathematically, just as the no-go theorem says, 
there does exist a local unitary transformation U a 

connecting \^/^ B (x, t a )) and \^ab(z> *i))> wrt h 

U A = M Ufa, to) Ml (8) 

But it is also clear that Alice cannot naively use this 
Ua to cheat, because ^^(x, to)} and \^A B (x,ti)) 
are not stationary states. Consequently, by the time 
Alice unveils at t = T, \^^ B (x,to)) would have 
evolved to 

\¥° B (Z,T))=U(T,to)\*T B frt )), (9) 

where we have assumed H§ = for simplicity. 
Therefore, in order to succeed, Alice must either (i) 

Artificially evolve (^^(af, T)) back to t = to when 

she unveils, or (ii) Freeze \^!^ B (x, to)) at t = to when 
she commits. But such manipulations are clearly 
not possible even with a quantum computer. Fur- 
thermore, even if they were possible, if particle- A is 
unstable with a lifetime r < T, then it is not possible 
for Alice to keep its position undetected until t = T, 
because there is a finite probability (1 — e~ T l T ) that 
by then there is no particle to detect. 

With this observations, we present below a QBC 
protocol which is unconditionally secure. We shall 
formulate it explicitly using neutrons which decay 
spontaneously into a proton(p), an electron(e), and 
an anti-neutrino(p), n — > p + e + v, with a mean 
lifetime of r = 885.7 seconds 19]. Nevertheless any 
unstable particles with a suitable lifetime will do. 
The required experimental setup is a double-slit ap- 
paratus similar to that used to demonstrate the wave 
nature of neutrons [2(| . So this protocol is realizable 
with available technologies. 

Commit: 

1. At time t = 0, Bob generates a neutron with 
momentum p (its spin is irrelevant) and sends 
it into a double-slit apparatus. With proba- 
bility 1/2, he randomly closes one of the slits 



before the neutron arrives. A detector screen is 
placed at a distance L from the slits on the exit 
side of the apparatus. If uninterrupted, the 
neutron enters the slits at t — to, and reaches 
the screen at t = t\. We assume that t\ << r, 
so that the possibility of neutron decay before 
t = ti is negligible. 

2. To commit to 6 = 0, Alice must find out which 
slit does the neutron go through. For 6 = 1, 
she must detect it on the screen and records 
its position. At t = t\, Alice must announce 
whether a neutron has been detected or not 
(the neutron makes it through the slits with a 
finite probability a). 

3. The above procedure is repeated N times. Or, 
to save time, the whole commitment process 
can be carried out in parallel with N identical 
double-slit setups. The latter case is assumed 
for simplicity, and the commitment phase ends 
at t = t. 

Unveil: 

1. At time t = T, Alice unveils the value of b 
and the corresponding neutron detection data. 
Specifically, for 6 = 0, she must specify the slit 
from which each of the aN neutrons emerged; 
for 6 = 1, she must reveal the position at which 
each of these neutrons was detected on the 
screen. 

2. Bob checks if Alice's data are consistent with 
her commitment. 

Having specified the protocol, we proceed to show 
that it is unconditionally secure. First of all, this 
protocol is obviously concealing, since the only in- 
formation disclosed by Alice during the commitment 
procedure is if neutrons have been detected. Next 
we show that it is binding. Let us first consider clas- 
sical cheating. If Alice had determined the which-slit 
information at t — to, then she would not be able to 
distinguish the single-slit and double-slit events, and 
consistent reconstruction of the interference pattern 
on the screen would be impossible. On the other 
hand, if she had detected the neutrons on the screen 
at t = t\, the resulting pattern is a superposition of 
single-slit and double-slit events, and it is impossi- 
ble to separate the two because they occur randomly. 
Hence Alice could not commit to one bit value and 
unveil another. If she did, she could only do so by 
pure guessing, but then her success probability is 
only of order 2~ aN . 

Next we consider the quantum cheating strategy 
suggested by the no-go theorem. As shown in Eq. 
dU), in accordance with the theorem, there is indeed 
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a unitary transformation Ua connecting the wave- 
functions corresponding to the b — and 6=1 
cases, which is essentially just the usual time evo- 
lution operator. However, as explained before, this 
strategy would work only if (i) Alice could freeze the 
neutron wavefunctions at t = to, or (ii) she could 
evolve the wavefunctions from t = T backward to 
t = t . Both strategies are obviously impossible. 
Moreover, even if they were possible, there are only 
N(T) = aNe~ T / T < aNe^ 1 neutrons left at t = T 
to be manipulated, as a finite fraction of them have 
already disintegrated. Consequently Alice must hon- 
estly detect the neutrons at t — to or t — fx, other- 
wise the neutron wavefunctions would evolve (spread 
and disintegrate) according to the laws of nature, 
which she cannot stop. Hence this protocol is bind- 
ing as well as concealing. This completes the proof 
that our protocol is unconditionally secure. 

From the above discussion, we see that time evo- 
lution of non-stationary quantum states plays an es- 
sential role in our protocol. In contrast, the time fac- 
tor is not considered in the no-go theorem [IjJ 0] , 
where the wavefunctions involved are assumed to be 
stationary. In our protocol, neutron wavefunctions 
are non-stationary in two senses: (i) The neutron 
spatial wavefunctions expand in size, and (ii) Neu- 



trons are unstable with a mean lifetime of about 15 
minutes [19|. These features are crucial to the se- 
curity of our protocol. We emphasize that formally 
there does exist a unitary transformation Ua con- 
necting the b — and b — 1 states, so the no-go 
theorem is mathematically correct. But Alice can- 
not use this Ua to cheat because, by the time she 
unveils, the quantum state has evolved to something 
beyond her control. 

In summary, using wave packets of unstable parti- 
cles instead of stationary states, we have constructed 
a new QBC protocol and shown that it is uncon- 
ditionally secure. Our protocol is basically a neu- 
tron double-slit experiment, similar to that used to 
demonstrate the wave nature of neutrons [20] . The 
security of this protocol is due to the facts that it 
is neither possible to stop the spreading of a wave 
packet, nor is it possible to evolve it backward in 
time. Moreover neutrons are unstable, so that detec- 
tion of their positions cannot be indefinitely delay, 
or they will disintegrate spontaneously and eventu- 
ally there will be no neutrons left to be detected. 
Our result shows that if non-stationary time evolu- 
tion of quantum states is taken into account, then 
the widely accepted no-go theorem we can evaded, 
and unconditionally secure QBC is possible. 
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